libpcap compatibility problem (Re: new bro "CURRENT" release - 0.8a57)

Christian Kreibich christian at
Wed Dec 10 07:35:28 PST 2003

Hi all,

On Tue, 2003-12-09 at 18:39, Vern Paxson wrote:
> Argh - the 0.8a57 release uses some new libpcap functionality
> (pcap_compile_nocap(), and calling pcap_freecode() with a bpf_program*)
> that isn't supported in older libpcap releases.  If someone could please
> contribute autoconf tweaks to deal with this incompatibility, I'd much
> appreciate it.

mhmm ... it seems that pcap_compile_nopcap() was added in 0.5, and
pcap_freecode() without the pcap_t in 0.6.1, so I guess there should be
a check for versions >= 0.6.1.

I'm attaching a patch that seems to work -- it checks whether the
pcap_compile_nocap symbol exists, and whether a program passing only one
argument to pcap_freecode() can build.

I haven't checked if the autoconf macros are available in older versions
as well (at that point I'm usually losing my patience :) Apply with -p0
in the toplevel directory of the source tree.

-------------- next part --------------
---        Wed Dec 10 15:01:12 2003
+++    Wed Dec 10 15:24:44 2003
@@ -174,6 +174,22 @@

 dnl Checks for library functions.
+dnl On top of the LBL check, we need to make sure that
+dnl we have pcap_compile_nopcap() and pcap_freecode(struct bpf_program *).
+AC_CHECK_LIB(pcap, pcap_compile_nopcap, [],
+   AC_MSG_ERROR([Please use at least libpcap version 0.6.1]),
+   [-lpcap]
+AC_MSG_CHECKING([if pcap provides pcap_freecode(struct bpf_program *)])
+   AC_LANG_PROGRAM([#include <pcap.h>], [ int main() { pcap_freecode(NULL); } ]),
+   AC_MSG_RESULT(yes),
+   AC_MSG_ERROR([Please use at least libpcap version 0.6.1])

More information about the Bro mailing list